feat(account): declare account-level subject mappings #3

Merged

mikluko merged 1 commit from mikluko/octant/1538-account-mappings into main

2026-09-02 05:56:33 +00:00

mikluko commented

2026-09-02 05:44:43 +00:00

(Migrated from github.com)

A mapping block on nsc_account writes nats-jwt's Mapping into the account claims: a source subject to one or more weighted destinations, each with an optional cluster. Destinations may reference the source's wildcards and use mapping functions such as partition().

nats-jwt validates nothing on encode, so the resource runs Mapping.Validate itself and refuses a source whose weights exceed 100 or whose subjects do not parse. A source declared in two blocks is refused as well: the claims hold one destination list per source, and the second block would replace the first without a trace.

Why

Octant T1538 under D1532: upnats needs to declare an account-level mapping that appends two partition tokens to every monitoring event before JetStream selects a stream, and research Q1533 found no release of this provider carries the attribute, while a config-file mappings block is a startup error under an operator resolver.

Testing

go test ./... green (acceptance tests run against the local terraform binary). Three new tests: TestAccAccountResource_withMappings decodes the signed JWT and checks every source, destination, weight and cluster, then updates the weights and checks the re-signed JWT; TestAccAccountResource_rejectsOverweightMappings and TestAccAccountResource_rejectsDuplicateMappingSource pin the two refusals. golangci-lint reports the same eight pre-existing findings as main, none in this diff. go generate ./... regenerated docs/resources/account.md.

Release

A new backward-compatible attribute: MESO under EffVer, so v0.14.0. The release is the repo's manual goreleaser flow (git tag -a v0.14.0, git push origin main --tags, goreleaser release --clean) and is left to the maintainer.

Authored by Claude (claude-fable-5-1) under Claude Code 2.1.257; diff reviewed against the final tree.

A `mapping` block on `nsc_account` writes nats-jwt's `Mapping` into the account claims: a source subject to one or more weighted destinations, each with an optional cluster. Destinations may reference the source's wildcards and use mapping functions such as `partition()`. nats-jwt validates nothing on encode, so the resource runs `Mapping.Validate` itself and refuses a source whose weights exceed 100 or whose subjects do not parse. A source declared in two blocks is refused as well: the claims hold one destination list per source, and the second block would replace the first without a trace. ## Why Octant [T1538](http://127.0.0.1:9876/T1538) under [D1532](http://127.0.0.1:9876/D1532): `upnats` needs to declare an account-level mapping that appends two partition tokens to every monitoring event before JetStream selects a stream, and research [Q1533](http://127.0.0.1:9876/Q1533) found no release of this provider carries the attribute, while a config-file `mappings` block is a startup error under an operator resolver. ## Testing `go test ./...` green (acceptance tests run against the local `terraform` binary). Three new tests: `TestAccAccountResource_withMappings` decodes the signed JWT and checks every source, destination, weight and cluster, then updates the weights and checks the re-signed JWT; `TestAccAccountResource_rejectsOverweightMappings` and `TestAccAccountResource_rejectsDuplicateMappingSource` pin the two refusals. `golangci-lint` reports the same eight pre-existing findings as `main`, none in this diff. `go generate ./...` regenerated `docs/resources/account.md`. ## Release A new backward-compatible attribute: MESO under EffVer, so `v0.14.0`. The release is the repo's manual goreleaser flow (`git tag -a v0.14.0`, `git push origin main --tags`, `goreleaser release --clean`) and is left to the maintainer. Authored by Claude (claude-fable-5-1) under Claude Code 2.1.257; diff reviewed against the final tree.